Thousands of people have received brain scans, as well as cognitive and genetic tests, while participating in research studies.
But could a curious family member identify one of them just from a brain scan? Do you want to embarrass a study participant?
The answer is yes, investigators at the Mayo Clinic reported on Wednesday.
A magnetic resonance scan includes the entire head, including the subject's face. And while the countenance is blurry, imaging technology has advanced to the point that the face can be reconstructed from the scan.
In a letter published in the New England Journal of Medicine, researchers at the Mayo Clinic showed that the required steps are not complex. But privacy experts questioned whether the process could be replicated on a much bigger scale with today's technology.
The subjects were 84 healthy participants in a long-term study of about 2,000 residents of Olmsted County, Minn. Participants get brain scans to look for signs of Alzheimer's disease, as well as cognitive, blood and genetic tests.
Over the years, the study has accumulated over 6,000 M.R.I. scans.
Computer scientist at the Mayo Clinic, photographed their faces and, separately using a computer program to reconstruct facets from the MRI's.
Then the team turned to facial recognition software. The program correctly identified 70 of the subjects. Only one correct match would be expected by chance, dr. Black said.
Admittedly, this is a fairly simple test.
But the fact that this is a straightforward test is "beside the point," said Aaron Roth, computer scientist and privacy expert at the University of Pennsylvania.
The more likely abuse may be more modest than the method tested by the mayo researchers Dr. Roth said. Imagine that a bad actor already knew that it was a case of a personal subject.
Under these circumstances, it should be less difficult to find that person's M.R.I. than to start with the scan and discover the subject's identity. The task is "unfortunately reasonably straightforward." Black said.
The privacy threat is real. Michael Weiner of the University of California, San Francisco.
Dr. Weiner directs a national study called the Alzheimers Disease Neuroimaging Initiative, which has enrolled 2,400 healthy people in an effort to find signs of dementia before a person shows symptoms.
With the publication of the Mayo Clinic, the Initiative's administrators say they are "sending letters to participating centers"
The data in the study are stripped of identifying information, like participants' names and social security numbers, but their MRI scans do include faces.
"There have been millions of downloads of images," said Dr. Arthur Toga of the University of Southern California, whose group sends out M.R.I. scans and other data to researchers who request them from A.D.N.I. About 6,300 investigators have received study data, he said.
Dr. Weiner is a participant in that study, and his brain scans are included in the research data.
"My genetics are there," he said. "All my tests are there. I bet there are a lot of images on the internet. You could match me to A.D.N.I.
"The question is, what can we do now?"
The obvious way to fix the problem would be to remove faces from M.R.I. scans stored in databases.
So, the images in this way would not help protect the privacy of millions of people whose scams are already stored by ADNI, the Mayo study and other large research projects.
Dr. Black said his group is working on another solution, but declined to say what it is. Yves-Alexandre de Montjoye, a privacy researcher at Imperial College, London, is questioned as to whether or not there is any point in the matter.
M.R.I. Data is used, "he said. The Mayo group's letter, he added, "is a good warning."